Certified Incident Handler (CIH) Practice Ecam

What guideline should NOT be followed during an incident post-mortem?

1. Prioritize incidents by their severity

2. Do not specify rules to prioritize the incidents

3. Encourage input from multiple team members

4. Focus solely on the incident resolution

The correct answer is: Do not specify rules to prioritize the incidents

The guideline that should not be followed during an incident post-mortem is one that advises against specifying rules to prioritize incidents. During a post-mortem, it is essential to prioritize incidents based on their severity to effectively allocate resources and attention to the most critical vulnerabilities. Establishing clear prioritization rules allows the team to systematically address issues, ensuring the most severe incidents receive immediate action, which enhances the overall incident response process and improves future preparedness. By encouraging a structured approach, the team can analyze incidents based on their impact on the organization, leading to better decision-making and resource management. A lack of prioritization could result in minor issues receiving too much attention while more severe incidents remain unaddressed, potentially leading to greater risks or losses. Including a focus on severe incidents also fosters a culture of accountability and continuous improvement, as teams can learn from past mistakes and successes. The other guidelines suggest encouraging collaboration and input from team members while also focusing on post-incident analysis rather than just resolution, both of which are essential for deriving meaningful insights from the incident and supporting organizational learning and future resilience.